Skip to content
Get packs

SSRF Metadata Pivot (CTF)

Traces server-side request forgery paths from a fetch point to internal metadata and accepted credentials, for CTF sandboxes

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This skill gives an AI agent a structured method for analysing server-side request forgery (SSRF) in a capture-the-flag or sandboxed training setup. It tells the agent to map where a server fetches URLs, which internal hosts and cloud metadata endpoints are reachable, what credentials can be extracted, and where those credentials are accepted. It is written as a downstream add-on that only runs after a parent skill, ctf-sandbox-orchestrator, has set up the sandbox assumptions, and it asks for replies in Simplified Chinese by default.

Great for

  • Students and security trainees working through CTF labs that involve SSRF
  • Security practitioners building or reviewing deliberately vulnerable sandbox environments
  • Teams using the parent ctf-sandbox-orchestrator skill who need the SSRF specialization

Skip it if

  • Testing real production systems or third-party servers without written authorisation, because the workflow is built around reaching internal hosts and extracting credentials
  • Users who have not installed and started the parent ctf-sandbox-orchestrator skill, since the file says this skill should not be used on its own

Try asking

  • “Trace the SSRF source in this webhook importer lab and show which internal hosts it can reach”
  • “Map the metadata endpoint path from the image fetcher to the token it returns in this CTF sandbox”
  • “Explain how the link-local token I extracted gets accepted by the downstream API in this lab”
  • “Package the minimal SSRF-to-access replay path as evidence for my writeup”
Step-by-step guide: how to use SSRF Metadata Pivot (CTF)Install, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-ssrf-metadata-pivot.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-ssrf-metadata-pivot.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-ssrf-metadata-pivot.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Set up an isolated CTF sandbox or lab first, and run the parent orchestrator skill before invoking this one
  • Ask the agent to record request methods, redirects and response behaviour before attempting any changes, as the skill instructs
  • Keep the evidence focused on one minimal replay path so the writeup stays reproducible

What's inside

  • agents/openai.yaml
  • references/ssrf-metadata-pivot.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.